Validation: #115 Keycloak OmniAuth Login
Ticket
#115 — Phase 1: Keycloak login with Authorization Code + PKCE
Board item #1337 on board-landscaping-assistant.
Shipped: OmniAuth OpenID Connect login with Keycloak, session-based auth, realm role extraction, graceful degradation without Keycloak.
Board item #1337 on board-landscaping-assistant.
Shipped: OmniAuth OpenID Connect login with Keycloak, session-based auth, realm role extraction, graceful degradation without Keycloak.
Environment
Local dev (archbox), prod cluster at
landscaping-assistant.tail5b443a.ts.net. Keycloak at keycloak.tail5b443a.ts.net/realms/landscaping.Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | OmniAuth callback creates session with username, email, roles | bundle exec rspec spec/requests/sessions_spec.rb | PASS | 7 examples, 0 failures |
| 2 | Realm roles extracted from ID token (realm_access.roles) | Spec: "extracts realm_access roles from the ID token" | PASS | Verified admin + super_admin compound role |
| 3 | Logout clears session and redirects through Keycloak end-session | Spec: "clears the session" + "redirects to the Keycloak logout endpoint" | PASS | Session cleared, redirect URL includes openid-connect/logout |
| 4 | Auth failure redirects with flash alert | Spec: "redirects to root with a flash alert" | PASS | Flash includes error message |
| 5 | App works without auth when KEYCLOAK_URL unset | Spec: "allows access to the root path without authentication" | PASS | 200 OK on root and properties paths |
| 6 | Full spec suite — no regressions | bundle exec rspec (101 specs) | PASS | 101 examples, 0 failures |
| 7 | CSRF protection — login uses POST only | OmniAuth.config.allowed_request_methods = [:post], button_to POST in layout | PASS | PR #134 QA review + PR #135 spec fix |
| 8 | No duplicate keycloak_configured? method | grep -r "def keycloak_configured" app/controllers/ | PASS | Only in ApplicationController |
| 9 | Keycloak realm live | curl keycloak.tail5b443a.ts.net/realms/landscaping/.well-known/openid-configuration | PASS | Verified during Step 1 (tofu apply) |
| 10 | 5 test users with correct roles | Keycloak Admin REST API | PASS | Documented in issue #115 comment #5 |
Verdict
PASS — all checks green. Code-level validation complete. E2E browser login will be verified after ArgoCD syncs the deployment (env vars from pal-e-deployments#188).
Discovered Issues
PR #135 — session specs used GET for OmniAuth request phase after CSRF fix removed GET from allowed methods. Fixed and merged.